Introduction

The Netherlands is witnessing a transformative era in data protection and algorithmic oversight, with the Dutch Data Protection Authority (DPA) taking pioneering steps to navigate the challenges posed by evolving technologies. This contribution sheds light on the significant progress made by the Dutch DPA in supervising algorithms and artificial intelligence (AI) while addressing broader privacy concerns.

Court rulings against tech giants Meta and Criteo reflect the increasing role of the judicial system in safeguarding privacy rights. The article also covers the DPA’s collaboration with international entities, cybersecurity initiatives, and updates on privacy risks in major tech companies.

The Dutch government’s continued influence in overseeing Big Tech, evident in negotiations with companies like Google and AWS, emphasises the importance of navigating the intersection of technology and privacy. As privacy considerations gain prominence in corporate landscapes, the Dutch DPA advises large companies to enhance transparency, aligning privacy practices with socially responsible business practices.

In the realm of data transfers, the adoption of the EU-US Data Privacy Framework stands out as a significant trend, posing challenges and opportunities for businesses. The contribution concludes by highlighting the Dutch DPA’s role in advocating for transparency and privacy considerations, providing guidelines for companies and emphasising the importance of aligning with evolving regulatory frameworks.

The contribution also highlights the Dutch DPA’s vigilance in scrutinising Tesla’s security cameras, ensuring privacy-friendly adjustments.

Major Strides in the Dutch DPA’s Approach Towards Supervising the Use of Algorithms/AI

The growing integration of generative AI within organisations and its implications for personal data have raised concerns. In response, the Dutch DPA has initiated various measures and initiatives to examine this matter.

Dutch DPA Asks for Clarification on ChatGPT

On 7 June 2023, the Dutch DPA announced that it had approached ChatGPT to gain clarity on the training methods of its generative chatbot. The inquiry included questions about how the platform utilises information from user interactions, the policies and procedures regarding the treatment of personal data sourced from the internet for training purposes, and the approach to handling generated responses that may be inaccurate, outdated, defamatory, or offensive.

2020-2023 Enforcement Agenda

As part of its enforcement agenda for 2020-2023, the Dutch DPA established a new unit in January 2023 dedicated to overseeing AI and algorithms, known as the algorithms co-ordination directorate.

This directorate plays a co-ordinating role in cross-sectoral investigations related to AI and algorithms. In addition to this co-ordination unit, the Dutch DPA bolstered its supervisory capacity for tasks specifically related to AI and algorithms, with the government committing to providing a yearly budget for these purposes.

First Algorithmic Risks Report Netherlands

On 17 July 2023, the Dutch DPA released its inaugural report on algorithm-related risks in the Netherlands. In the report, the DPA acknowledges the positive impact and the value creation potential of algorithms and AI, but also highlights the need for significant steps by the Dutch government and industry to better manage and understand these technologies, including risks posed by them.

The DPA underscores two current challenges: the rapid adoption of AI innovations in society, presenting both opportunities and risks, and the imperative for the Netherlands to gain insight into the use of high-risk algorithms that profoundly impact people’s lives.

The Dutch DPA also warns against the deployment of the latest AI innovations, cautioning organisations to thoroughly assess risks before experimenting with applications such as candidate evaluations, fraud detection, customer assessments, or patient evaluations.

Furthermore, this was the first report to provide a comprehensive overview of developments, risks, and challenges in the Netherlands, presented from an overarching risk perspective. The Dutch DPA plans to publish this report every six months to provide insights into recent developments, current risks, and associated challenges. Since the beginning of 2023, the Dutch DPA has assumed the role of the co-ordinating authority for risk signalling, advice, and collaboration in algorithm oversight, positioning the Netherlands at the forefront of international efforts.

The report concludes by emphasising the importance of periodic reports on algorithm risks as a crucial instrument for this oversight approach, with global efforts underway for standardisation and co-ordination of regulations and oversight on algorithms and AI.

International Collaboration on AI Supervision between the European Commission and the Netherlands

UNESCO, the European Commission, and the Dutch Authority for Digital Infrastructure have initiated a collaborative project called “Supervising AI by Competent Authorities”. The project aims to design institutional frameworks for the ethical governance of AI in the Netherlands. Financed through the European Commission’s Technical Support Instrument, the initiative addresses key questions surrounding AI governance, adaptability to rapid technological advancements, and the balance between regulation and innovation.

The collaboration focuses on analysing the optimal institutional design for AI supervision in compliance with the EU AI Act and UNESCO’s Recommendation on the Ethics of AI. Recognising the challenges and potential risks of AI, the project seeks to capitalise on its opportunities while safeguarding human rights, security, and ethical considerations.

Inspector General Angeline van Dijk of the Dutch Authority for Digital Infrastructure emphasises the importance of balancing AI’s opportunities and risks. UNESCO will support Dutch authorities by producing a comprehensive report on AI supervision, developing case studies, outlining best practices, and organising training sessions to enhance institutional capacity.

UNESCO’s core function involves promoting ethical development and application of emerging technologies. The collaborative project aligns with UNESCO’s global standard, the Recommendation on the Ethics of AI, adopted in November 2021. The Recommendation provides policy guidance across eleven areas for effective AI regulation and oversight based on universal values and principles.

Gabriela Ramos, UNESCO Assistant Director-General for Social and Human Sciences, emphasises that AI governance is a societal discussion and underscores the need for effective frameworks rooted in ethical and moral values. The project aims to help Competent Authorities across the European Union enhance their capacity to ensure AI system compliance with the EU AI Act and ethical standards. The experience gained will contribute to UNESCO’s work with member states, assisting in the development of benchmarks and frameworks for stronger, safer, and more ethical AI deployment globally.

Second Algorithmic Risks Report Netherlands

In its second report, the Dutch DPA emphasised the increasing risks associated with AI and algorithms, particularly with the rise of generative AI. Issues such as disinformation, privacy violations, and discrimination are becoming more prevalent, outpacing society’s ability to regulate and supervise these technologies effectively. The Dutch DPA, acting as the national coordinating authority for AI and algorithm supervision since early 2023, highlights the urgent need for improved risk management and incident monitoring.

In its second AI and Algorithmic Risks Report Netherlands, the Dutch DPA recommends the implementation of a comprehensive national master plan by 2030. This plan aims to ensure effective management and control of AI-associated risks, promoting responsible and safe AI use across various sectors. The proposed strategy emphasises human control and oversight, secure applications and systems, and strict rules for organisational control.

To achieve this, the Dutch DPA suggests clear yearly goals and agreements, incorporating the implementation of regulations like the Artificial Intelligence Act (AI Act). The plan emphasises the importance of human awareness and understanding of algorithms and AI in daily life, fostering trust and responsible use.

The report acknowledges the necessity of investing in education to ensure people of all ages understand the impact of algorithms and AI on their lives. This knowledge is crucial for individuals in various roles, from teachers and doctors, to workers and organisational leaders. The report underscores the need for structural investments in knowledge to enable society to navigate the use of algorithms and AI effectively.

The rise of generative AI poses high risks, including disinformation, manipulation, and discrimination. The AI Act, scheduled to take effect in 2025, will provide oversight for foundation models and the organisations developing them. The Dutch DPA calls for proactive efforts from companies and organisations in risk management, internal supervision, and control mechanisms to ensure reliable and safe AI use, emphasising that effective regulation goes beyond setting up supervision alone.

Tesla Cameras under Scrutiny by the Dutch DPA

In February 2023, the Dutch DPA announced that Tesla had made privacy-friendly adjustments to the settings of its built-in security cameras in response to an investigation by the Dutch DPA. The Dutch DPA examined Tesla’s “Sentry Mode”, designed to protect cars from theft or vandalism by capturing footage using four external cameras. Previously, when Sentry Mode was activated, the cameras would continuously record the surroundings of a parked Tesla, storing one hour of footage. Following software updates, the cameras are now defaulting to the off position. If users choose to activate them, the cameras will only store a maximum of 10 minutes of footage.

The Dutch DPA found that parked Teslas in Sentry Mode often recorded individuals near the car without their knowledge, storing the footage for an extended period. Tesla responded to the investigation by implementing changes. Sentry Mode now activates only when the car is physically touched, not in response to “suspicious” movements around the vehicle. In such instances, the car does not automatically start recording; instead, the owner receives a text message on their phone.

While the car can still capture camera footage, this feature must be manually enabled by the user. When recording, the car’s display screen indicates it, and the headlights emit a special light signal to inform people that they are being filmed. By default, the car retains one minute of footage, with the option for the owner to increase this to ten minutes. Notably, the captured footage remains within the car, and there is no capability to share the recordings with Tesla.

The Dutch DPA’s investigation did not result in any fines or sanctions against Tesla, as it determined that the legal responsibility for the captured footage lies with the car owner, not Tesla. The Dutch DPA welcomed Tesla’s modifications, emphasising their role in protecting passersby and reducing the risk of Tesla drivers violating the law by illicitly filming people.

The rules governing in-car cameras align with those applicable to cameras installed by individuals around their homes. Filming public roads is generally prohibited, with exceptions permitted only in cases of serious security concerns, such as frequent car break-ins in the vicinity. Camera owners bear the responsibility of correctly configuring their devices and respecting the privacy of others.

Cybersecurity NCSC – One-Stop-Shop for Reporting Cyber Threats

The Dutch government is intensifying collaboration in cyber threat warnings, with three cybersecurity entities establishing a unified reporting centre for threat and vulnerability notifications. This move is part of the preparation for merging these three organisations into a single national cyber entity by the end of 2025. The involved entities include the National Cyber Security Centre (NCSC) under the Ministry of Justice and Security, the Computer Security Incident Response Team for Digital Service Providers (CSIRT-DSP), and the Digital Trust Center (DTC) under the Ministry of Economic Affairs and Climate.

The shared objective is to enhance digital security throughout the Netherlands. These entities, namely NCSC, CSIRT-DSP, and DTC, are now working closely to ensure timely warnings for all organisations if they are victims or targets of cyber threats, regardless of their size or sector. The collaboration aligns with a key focus of the Dutch Cybersecurity Strategy, aiming for better threat visibility.

The government receives daily information about vulnerable or compromised systems from security researchers, ethical hackers, and domestic and international partners. This information is crucial to reach the affected companies swiftly, allowing them to take preventive action. Government-issued warning messages are sent when a cyber threat is identified for an organisation in the Netherlands.

To streamline the process, the three entities have established a single reporting centre where cybersecurity experts and partners can share information about cyber threats and incidents. This central reporting centre, managed by the NCSC as the national Computer Emergency Response Team (CERT), can be reached at cert@ncsc.nl. The NCSC assesses the quality of the information and initiates the notification process involving all three organisations, using a transparent and consistent evaluation framework based on the principle of sharing information as much as possible.

A unified assessment framework has been recently developed by the three organisations to determine when a warning message is necessary. Approximately 30 types of cyber threats have been designated as always warranting a warning, such as an open server port due to a configuration error or the use of an outdated cloud application with security flaws.

The collaboration extends beyond threat warnings, as the entities already share IT systems. In the coming months, they plan to further develop an integrated, scalable, and robust warning service to support businesses in enhancing the digital security of their IT systems across the Netherlands.

Continuing Influence by the Dutch State

The Dutch government continues to have a positive influence on new tech, and has an important role in negotiating GDPR-compliant agreements with major cloud providers, such as Google and Amazon Web Services (AWS), who are not typically eager to accept changes to their standard contractual documentation. On 1 June 2023, the Dutch government announced that it had entered into a framework agreement with AWS for government-wide use of (cloud) services.

On 20 April 2023, the Dutch Ministry of Education, Culture, and Science provided an update to the Dutch government regarding the progress of agreed-upon measures aimed at addressing privacy risks identified in Google Workspace. Subsequent negotiations with Google resulted in agreements specifying (i) timelines for addressing outstanding risks; (ii) ongoing monitoring of GDPR compliance post-remediation; and (iii) the implementation of a data transfer impact assessment.

On 1 June 2023, an agreement was reached with Google to mitigate the high risks identified in the DPIA. This regulatory approach by the Dutch Ministry of Justice toward overseeing Big Tech has garnered, and continues to garner, global admiration.

On 5 July 2023, the Ministry of Education, Culture, and Science informed Parliament that Google’s remedial actions were deemed sufficient. In 2020, the Dutch government initiated a Data Protection Impact Assessment (DPIA) for Amazon Web Services (AWS), leading the Ministry of Justice and Security to engage in negotiations with AWS for GDPR-compliant usage of its products and services.

However, when the Dutch government and big US tech providers fail to reach an agreement, the Dutch Government is not afraid to show its teeth. On 31 October 2023, the Financieele Dagblad (Dutch financial newspaper) reported that the former Dutch State Secretary of Digital Affairs asked the Dutch DPA to investigate Meta’s personalised advertising practices in relation to government communications through Facebook. According to the Dutch government, Facebook is not sufficiently transparent as to the process behind this, so that it is impossible for Facebook users to give meaningful consent.

Data Protection in the Dutch Courts

Tracking cookies

On 18 October 2023, the District Court of Amsterdam issued a ruling in summary proceedings against Criteo, an AdTech company engaged in the placement of third-party tracking cookies across users’ computers via various websites, with the purpose of monitoring user behaviour for targeted advertising.

The legal proceedings were initiated by a Dutch individual (“the Plaintiff”), who alleged that Criteo had infringed upon his privacy and data protection rights. The Plaintiff argued that Criteo violated these rights by deploying third-party tracking cookies on his computer without obtaining consent, processing his personal data without authorisation, and inadequately responding to his requests to cease processing, provide access to, and delete his personal data collected not only by Criteo but also by other entities within the real-time bidding (RTB) chain that received his data.

The court determined that Criteo, functioning as a joint controller, bears the responsibility to ensure proper consent is obtained. It emphasised that Criteo cannot evade accountability by relying on its partners, even if the task of obtaining consent is outsourced. Additionally, the court held that the onus is not on the data subject to disable cookies through browser settings or opt out of cookie usage.

The court issued a series of directives compelling Criteo to take specific actions within designated timeframes. These directives include refraining from placing cookies on the Plaintiff’s computer until valid consent is obtained, informing him about the group companies and third parties that have accessed his personal data (including the cookie ID), granting him access to his personal data, deleting all unlawfully processed personal data, and notifying relevant entities and third parties about the deletion request so that they may also erase unlawfully acquired personal data, as applicable.

Collective action against Meta

On 15 March 2023, the Amsterdam District Court delivered a groundbreaking verdict against Meta, establishing a precedent that upholds the privacy rights of Dutch residents. The District Court concluded that Meta had been unlawfully processing consumers’ data for advertising purposes, violating their privacy over an extended period. Consequently, the court determined that Meta’s practices were unjust towards consumers, resulting in the company’s unjust enrichment.

This declaratory judgment creates the potential for damage claims, although the feasibility and mechanics of such claims remain uncertain. The anticipation is that the trend of GDPR-related class actions navigating through the Dutch legal system will continue to gain momentum in the coming years.

Transparency of Large Companies Regarding Privacy Practices

On 5 December 2023, the Dutch DPA announced that it is advising large companies to enhance transparency regarding their privacy practices, suggesting the inclusion of privacy policy details in annual reports. The Dutch DPA has developed two guidelines to assist companies in achieving this. Emphasising the alignment of privacy with socially responsible business practices, the Dutch DPA’s Vice-Chair Monique Verdier notes the increasing focus on sustainability and work conditions, making privacy considerations a natural extension.

With the growing use of data in the digital age, the Dutch DPA encourages companies to actively showcase their approach to privacy risks to build trust with stakeholders, such as customers, employees, and shareholders. While legal compliance with the GDPR is mandatory, the Dutch DPA recommends additional openness about privacy practices.

The authority urges larger companies to proactively communicate their privacy efforts, with annual reports serving as a potential starting point. Recognising existing corporate inquiries on improving privacy accountability, the Dutch DPA provides guidelines for integrating privacy information into annual reports.

Additionally, the Dutch DPA suggests that boards of directors or supervisory boards play a catalytic role in ensuring privacy compliance within companies, offering guidelines titled “The Board of Directors or Supervisory Board and Privacy: Your Role as Supervisor” to facilitate discussions with executive leadership on privacy management.

Data Transfers

The adoption of the adequacy decision for the EU-US Data Privacy Framework (EU-US DPF), succeeding the Privacy Shield, stands out as a highly impactful trend in data protection. This decision restores the option for data transfers between EU organisations and those in the United States that have certified their compliance with the EU-US DPF principles. In alignment with the EU, both the UK and Switzerland have introduced their respective transfer mechanisms, namely the UK Extension to the EU-US DPF and the Swiss-US DPF.

Businesses that previously depended on the EU-US Privacy Shield and Safe Harbor frameworks now confront a new challenge. They must decide whether to attempt, for the third time, to validate their compliance with a framework that might be temporary or invalidated. Given the expressed intention to initiate legal action against the EU-US DPF by Maximilian Schrems, the individual responsible for invalidating its predecessors, a thorough review by the Court of Justice EU can be expected in the coming years.

On the other hand, pursuing certification could ease the contractual and compliance challenges accumulated over the years. However, there is a possibility that the DPF may heighten the burdens on US companies, exposing them to intricate litigation and regulatory risks.

Certain companies may welcome the DPF as a means to align with regulatory requirements. In various European countries such as France, Italy, Norway, the Netherlands, and Sweden, challenges have arisen regarding the use of online tracking and analytic tools. Data protection authorities have questioned the lawfulness of transferring data to US providers.

From the data protection authorities’ perspective, major tech providers have struggled to implement adequate “supplementary measures” to safeguard European analytics data against government surveillance in a manner deemed “essentially equivalent” to EU law. US big tech companies are and will likely continue to automatically transition to adopting the DPF to facilitate legal cross-border data transfers.

Conclusion

The DPA stands at the forefront of global efforts in data protection and algorithmic oversight, showcasing remarkable achievements. From influencing negotiations with Big Tech to scrutinising AI and algorithm risks, the DPA has been proactive in safeguarding privacy.

Landmark court rulings against Meta and Criteo, coupled with the DPA’s guidance to enhance transparency in privacy practices, reflect a growing emphasis on responsible business conduct. The international collaboration with UNESCO and the European Commission underscores the Netherlands’ leadership in ethical AI governance.

The adoption of the EU-US DPF for data transfers presents both challenges and opportunities, highlighting the complex landscape of data protection. The DPA’s call for a national master plan by 2030 reinforces its commitment to responsible AI use and privacy considerations.

In essence, the Dutch DPA’s multifaceted approach positions the Netherlands as a pioneer in addressing the evolving dynamics of technology and privacy. As digital landscapes continue to evolve, the DPA’s proactive measures set a noteworthy precedent for global data protection efforts.